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Abstract. We introduce a new family of binary linear codes suitable for steganographic. matrix 
embedding. The main characteristic of the codes is the staircase random block structure of the 
generator matrix. We propose an efficient list decoding algorithm for the codes that finds a close 
codeword to a given random word. We provide both theoretical analysis of the performance and 
stability of the decoding algorithm, as well as practical results. Used for matrix embedding, these 
codes achieve almost the upper theoretical bound of the embedding efficiency for covers in the 
range of 1000 - 1500 bits, which is at least an order of magnitude smaller than the values reported 
in related works. 
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1 Introduction 

A widely accepted security model for steganographic systems was given in [T]. It is modelled as security 
in a form of visual and statistical undetectability. How much data can safely be embedded in a cover 
without being detected is given in [2]. 

One method for achieving undetectability is matrix embedding. It has been first informally introduced 
in [3j and more formally in ||4] and [5j. It is a steganographic method that uses (n, k) linear binary codes 
C to transmit messages of length n — k bits, embedded into arbitrary covers of n bits using as small as 
possible number of changes. Matrix embedding addresses two important design goals in the steganography 
schemes: 1. To achieve as high ratio as possible between the size of the embedded message and the size 
of the cover message (so called payload ); 2. To achieve as high security as possible in a form of visual 
and statistical undetectability. 

The so called cover in practice can come from different sources such as binary images, textual or binary 
files, line drawings, three-dimensional models, animation parameters, audio or video files, executable code, 
integrated circuits and many other sources of digital content El Ch.l], 

In E] the theoretical bound that is achievable with matrix embedding was given and it was shown 
that random linear codes asymptotically achieve the theoretical bound. 


1.1 Related Work 


Having just a theoretical result that long random linear codes can achieve the embedding capacity, is far 
from satisfactory in practice. Thus in a series of works, different practical matrix embedding algorithms 
have been proposed. In [7], two practical schemes for matrix embedding based on random linear codes and 
simplex codes were proposed. These schemes use relatively small values of k < 14, one reason being that 
the embedding algorithm takes 0(n2 k ) operations. Modifications of the schemes from [7: with improved 
efficiency were proposed in a series of papers such as jSI9ll0llllll2| . These schemes, although efficient, 
do not offer embedding efficiency close to the upper theoretical bound. In m , the authors propose to 
use low-density generator matrix (LDGM) codes (defined in [14]) for matrix embedding. Because of the 
efficient decoding algorithms for LDGM codes, the proposed schemes are quite fast and achieve very 
good embedding efficiency close to the theoretical bound, but for large n in the range 10 5 — 10 6 . 


1.2 Our Contribution 

The contributions of this paper are severalfold: 1. We define a new family of binary linear codes with 
a generator matrix G that has a specifically designed staircase random block structure. 2. We propose 



an efficient list decoding algorithm for these codes. 3. We perform an initial theoretical analysis of the 
stability and the complexity of the decoding algorithm. 4. We use these codes for matrix embedding. 5. 
We report the theoretical and experimental results in comparison with similar codes. The results show 
that our codes, while practical for matrix embedding, are also competitive with the best known codes. 
In particular, our codes achieve almost the upper theoretical bound of the embedding efficiency for the 
length of the cover in the range of 1000 — 1500 which is at least an order of magnitude smaller than the 
values reported in related works. 

2 Basics of Matrix Embeding 

Throughout the paper, we will denote by C C FJ a binary (n, k ) code of length n and dimension k. We 
will denote the k x n generator matrix of the code by G, and the ( n — k) x n parity check matrix by 
H. The Hamming distance between x, y £ will be denoted by d(x, y), and the Hamming weight of a 
word x £ Fj by wt{s). 

A crucial characteristic of a code that we will use is its covering radius R , defined as R = max xg |fj ci(x, C) 
where d(x,C) = min cS c d(x, c) is the distance of x to the code C. The average distance to a code C [7] is 
defined by 2~ n £] x6F „ ^( x ^)> an d ^ represents the average distance between a randomly selected word 
from Fg and the code C. Clearly, R a < R. 

Suppose that we want to embed a message m € M = F^ - * in a given cover object y € F£ . Without 
loss of generality, both can be considered as random binary strings. Furthermore, the position of the 
cover object in a document (the block where the message is to be embedded) is known to both the 
sender and the recipient. 

Definition 1. A steganographic scheme on F(( with a distortion bound R is a pair of embedding and 
extraction mappings Emb : F^ xA4 —> F((, Ext : F£ —> A4, such that 

Ext(Emb(y, m)) = m, Vy £ F£ , Vm £ Ai, and 
d(y,Emb(y,m)) < R. 

The embedding rate, or relative message length, is the value a = (n—k)/n, and the lower embedding 
efficiency is the value e = (n — k) / R. For the average absolute distortion (average number of changes) 
R a , we have the average embedding efficiency e a = (n — k)/R a . 

Let C be a binary (n, k) code with a generator matrix G and a parity check matrix H, both given 
in a systematic form. We assume that the sender and the recipient share the matrix H (and thus the 
matrix G as well). 

Algorithm [Tj taken from (5] describes a general matrix embedding scheme for any linear code C. 


Algorithm 1: Matrix embedding 
Emb( y, m): 

1. Set z = yH T + m. 

2. Let Co be any such that coH T = z. 

3. Find the closest codeword xG to Co using some efficient algorithm. 

4. Set e = Co + xG. 

5. Embed the message as y' = y + e. 

Output: A stego object y'. 

Ext(y'): 

Extract the message as m = y'H T . 

Output: The extracted message m. 


Fig. 1. Algorithm for matrix embedding using code C 

The crucial step in Algorithm 1 is Step 3, i.e., Ending the closest codeword xG to c 0 . Thus, the 
performance of such a scheme is determined by the covering radius R of the code C which guarantees 





a lower bound on the embedding efficiency, but also on the average distance to the code R a which 
coincides with the average distortion. Therefore, the art of designing a practical steganograplric scheme 
lies in finding codes of small average distance R a for which efficient algorithms for finding a codeword 
within R a exist. However, both problems are known to be particularly difficult and challenging. 

It is known [7] that when n —> oo, random codes asymptotically achieve the upper bound for the 
embedding efficiency e for a given embedding rate a: 

e < ° 0<«<1 ( 1 ) 


where H is the binary entropy function. 

The authors of m report several LDGM codes of dimension n = 10000 and n = 100000 with 
extremely good embedding efficiency. However, there are no known (to the authors’ knowledge) codes, 
of smaller dimension, close to the bound Q, or to the codes from m • Furthermore, to the authors’ 
knowledge, the codes reported in m have currently the best performance regarding embedding efficiency. 


3 Staircase-Generator Codes 


We consider a binary (n, k ) code C with the following generator matrix in standard form: 



Each Bi is a binary matrix of dimension ki x n, whose structure will be discussed shortly, and 
each B[ is a random binary matrix of dimension )U( A kj x so that k = k\ + k 2 + ■ • • + k v and 

n = k + ni + n 2 + • • • + n v . Further we set Ki = k± + ■ ■ ■ + ki and Ni = ni + • • • + 7ij. We will call these 
codes - Staircase- Generator codes. 

Note that a code with generator matrix of the form ([2]) can be considered as a generalization of at least 
two well known constructions, taking for example the extended direct sum (EDS) and the amalgamated 
direct sum (ADS) construction [Uj. Indeed, it can be seen that the codes ([2]) are a generalization of the 
EDS construction of the codes with generator matrices [Ik 1 B 1 ], . .., [I Kv B v \, since the matrices B[ are 
chosen at random. On the other hand, § can be seen as an amalgamation of the codes with generator 
matrices 

/ B x B' 2 ... B[_i 

0 B 2 


V 0 0 ZV , 

for each i £ {2,... ,v}. 

We should emphasize that, we do not impose any condition on the normality of the codes being 
amalgamated. In the standard ADS construction, such conditions are necessary in order to prove the 
improvement on the covering radius. However, in the general case where more than one coordinate is 
amalgamated, it is much more difficult to theoretically estimate the improvement, and some attempts 
have not given the desired results [Hl- 


and Ik. 


Bi 


3.1 An Algorithm for Matrix Embedding Using Staircase-Generator Codes 

We describe a general list decoding algorithm (Algorithm]^ for the code C, that can be used for finding a 
codeword close to a given random Cq. Under the condition that Algorithm [2] is efficient, we immediately 
















obtain an efficient variant of Algorithm [l] for matrix embedding. Thus, two important questions about 
Algorithm [2] need to be answered: How efficient it is and what is the expected weight of the obtained e. 
In order to answer these questions, we discuss several different design choices. 

First, we need to fix some notations. Let G, denote the submatrix of the generator matrix G of size 
Ki x (Ki + Ni) consisting of an identity matrix Ik % concatenated with the matrix of the entries from the 
first Ki rows and the columns k + 1,..., k + rii of G. Further, let u>b denote a small constant that we 
will refer to as round weight limit. 


Algorithm 2: Decoding 

Input: A vector Co £ FJ, a generator matrix G of the form and a starting weight limit w\. 
Output: A vector e € FJ of small weight, such that xG = e + Co, for some x £ Fjj. 

Procedure: 

Let X; represent the first Ki bits of the unknown vector x. During decoding, we will maintain 

lists Li, Z/ 2 ,..., L v of triples (x;, e*, b;) where |x,| = Ki, |e;| = Ki + Ni, |b;| = I<i + Ni, that 

satisfy 

x;Gi = e, + bi_i, and wt(ei) < Wi (3) 

Step O'. Let bo = co[l... fci]||co[fc + 1... k + m] and xo and eo be vectors of dimension 0. Set a 

starting list L 0 = [(x 0 , e 0 , b 0 )]. 

Step 1 < i < v: 

For each (xj_i,ej_i,bi_i) £ Li- 1 , add all (x,,e;,bi) to Li, that satisfy © and wt(fii) ^ Wb, 
where Xi = Xi_i||®j, e; = e.;_ i\\d and Xi and e; are unknown parts of x, ; , e^. Further, set 

b, = bi_x||xi||xiB'. 

If \Li\ < L then Wi+i = Wi + 1, otherwise Wi+i = Wi. 

Return: (x„,e„,b„) £ L v with minimal wt(e v ). 


Fig. 2. Algorithm for finding a codeword close to a given random word 


3.2 Choosing the Matrices Bi 

Note first, that at each step Step i, effectively, we work with the codes Ci with generator matrices 
Gi = [Iki Bi\. In particular, we find all the codewords XiGi such that x,G, is within a radius u>i of a 
word bj_i. Thus, it is desirable that the codes Ci have as small as possible covering radius. For efficiency 
reasons of the algorithm, these codes also need to be relatively small. Luckily, for small codes, it is not 
hard to find exactly the least possible covering radius. The authors of [T6| provide a nice classification 
of the least covering radius of small codes. For our purposes, for i > 1, we use small codes of covering 
radius R = 1, and some of the possible choices are given in Table [T] For i — 1, we typically, choose the 
code Ci to be of very high rate. Thus we don’t need to choose it with particular properties (although it 
is possible), since it is expected that it has low covering radius. 


Table 1. Concrete codes (n, k)R of covering radius R = 1, with generator matrix [I B] 


(n, k)R 

matrix B 

(2,1)1 

(1) 

(3,1)1 

(11) 

(3,2)1 

(!) 


( x \ 

(4,3)1 

1 


w 


(n, k)R 

matrix B 

(5,3)1 

( 

T F 

11, 


(5,4)1 


1 

1 

W 


















3.3 Average Distortion Estimates 


In order to keep the complexity of Algorithm [2] low, not only need the codes Gi be small, but also 
the size of the maintained lists needs to be low as well. Our algorithm chooses the size of the lists to 
be bounded by some constant L. In this case we can quite accurately estimate the average distortion 
achievable by Algorithm [2j that we will denote by R a i g . Note that in general R a ^ R a ig- The following 
theorem provides an estimate of R a i g - 

Theorem 1. Let C be a ( n,k ) code with a generator matrix G of the form Jf- Then, in Algorithm [1| 
with round weight limit Wb, we have that at each step i, 1 ^ i ^ v, 

1. The expected number of vectors e,; £ F^ i+Ni such that wt(ei) = j, is Vi(j) where: 

/ fci+ni\ 

Vi(j) = , for 0 < j < w u 

V-(O) = ^7Vi_i(0), Vi(j) = 0 for j > Wi and 

min ti,w b ) / ki+m\ 

Vi(j)= E 2 n -i ' Vi ~^ ~ ^ for 0 < 3 < W i ~ 

t=0 

Wi 

2. The expected size of the list Li is E^')- 

3=0 

3. [Raig] is the smallest j such that V v (j) ^ 1. 


Proof. 1. Since there are ( fcl + rai ) different ways to make exactly j changes in k-\ + n\ bits, and there 
are 2 kl codewords in C\ (the code with generator matrix [I B{\), it can be expected that among all 

codewords, 2 kl = Vi (j) will be at distance exactly j from a random word in ¥ kl+ni . 

Further, if at Step i, Vj_i(0) is the expected number of vectors ej_i of weight 0, in the next step, 
this number reduces to 2 ki Fi_i(0). 

The value of V, (j ) can be obtained as follows. At each Step i we test each a of weight wt^ef) = 
l < Wb and each e,_i in the list !/*_i for consistency with ([3|. If consistent, e, belongs to V,(j) only 
if iut(ej_i||ej) = j, i.e., only if e,_i belongs to Vi-\{j — £). Again, on average, l/2 ni of the tested a 
satisfy ([3]). From here, we immediately obtain the claimed value for Vi(j). 

2. Since the list Li contains all vectors e,; of weight ^ Wi, we can estimate its size by taking the sum 
of all Vi(j), 0 < j < Wi. 

3. In the last Step v, if V v {j) ^ 1, then we can expect that in the list L v , there is an element e' v of 

weight j. Taking the smallest such j determines the expected average distortion. □ 


As mentioned in Subsection |3.2[ for better results, in practice, we use matrices Bi as in Table [lj that 
guarantee that the codes C t , i > 1 with generator matrix [R-, Bf\ have covering radius 1. Thus we can 
restrict the choice of the round weight limit Wb to small values, typically, 1 or 2. Calculating the average 
distortion for concrete parameters using Theorem [l] shows that the choice of Wb = 2 gives better results 
(cf. Section [4]). 


3.4 List Estimates 

Theorem [l] not only provides the average distortion obtained using Algorithm [2j it also gives the size of 
the lists Li at each step of Algorithm [2] For the efficiency of the algorithm it is important to know at 
what conditions the lists grow or decrease from one step to another. 

Let Bi{j) denote the ball of radius j around the zero vector of length I\i + Ni , containing the vectors 
ej, with wt(ei) ^ j obtained in AlgorithmpJ Further, we denote by \Bi(j)\ the expected size of Bi(j). 
Then, using the notation from Theorem [E|I?i(j)l = Ss=o^*( s )’ anc ^ l-M = \Bi{wi)\. Directly from 
Theorem [l] we have the following lemma. 






Lemma 1. Let Wb = 2. Then, 


when Wi+\ = Wi 

|Li+i| = |.6i+i(wi+i)| 
and when Wi+i = lUj + 1, 

|Lj+i| = |-Si+i(w,:+i)| 


1 I T | i (h+ 1 + rai+l) i„, 1 ni . 

I L *I + -- \B l {w i -l)\ + 


2"i + l 


2 ni + l 


^fci + i+n i+ i^ 

2 ni +i 


|Bi(wi-2)|, 


(fc i+ i+n i+ i + 1) 

-2^1-+ — 2 ^ 


(4) 

(5) 

□ 


Before continuing, for clarity of the exposition, we make two simplifications. 

First, without loss of generality, we can assume that at a given Step i only \B i (wi)\,\B i (wi — 
1)|,..., | Bi(wi — f)| > j^-, while |i?j(0)|,..., \Bi(wi — £ — 1) | < ^ for some integer s. Thus for big 
enough s, we will take |-B,(0)| = 0,..., | Bi(wi — t — 1)| = 0. (Indeed, this can be safely assumed for 
|.Bj(0)| since |£?j(0)| —>• 0 as i grows.). Second, we assume that ki = k 2 , rii = n 2 for all i ^ 2. In practice, 
we will typically choose such parameters. 

Proposition 1. Let Wb = 2. Let at Step i, \Bi(j)\ > 0, for j > Wi — t, and |2?j(j)| = 0, for j < Wi — t. 
Then, if Wi +1 = Wi, we have that: 


k 2 + n-2 , 


I Bi(wi - t)\ > \B i+1 (wi - t)|, 

I Bi(wi - t + 1)| > \B i+1 (w.i -t + l)\ if and only if 2 » 2 '^^ I B.^wi - t)\ < \ B.^wt - t + 1) |, 
\Bi{j)\ > | B i+ 1 (j)\,Wi - t + 1 < j < if and only if 
(fc 2 + n 2 )\Bi{j — 1)\ + ( fe2 +" 2 ) \Bi(j — 2)\ 


2 n2 - 1 




( 6 ) 

(7) 

( 8 ) 


Proof. The proof is rather straightforward. We have: 

\B i+1 \(wi -t)= 2 ^-| Bi{wi - t )| < | Bi(wi - t)\, 
since \Bi(wi — £ — 1)| = \Bi(wi — t — 2)| =0 from the condition. Further, 


\B i+1 (wi-t+l)\ 


\Bj(wj-t+l)\ + (fc 2 + n 2 )\Bi(wi-f)\ 
2«2 


Now, directly, it can be seen that |^rf \Bi(wi—t)\ < \Bi(wi — t + l)\ is equivalent to \B i+ i(wi — t +1)\ < 
I Bi(wi - t+ 1)|. 

Very similarly, the last claim follows directly from the expression for |B.j +iC?)l- □ 


The previous simple proposition implies that if at Step i, ([7]) and ([8]) hold, in the next Step i + 1, for 
all j, \B i+ i(j)\ < \Bi(j)\. When j = Wi, this guarantees that at Step i+1 the size of the list L i+ \ will be 
smaller than in the previous step. However, even if Q or Q for some weight j is not satisfied at Step 
i, at a later step i + s, if = Wi, an equivalent expressions to ([8]) (for i + s instead of i) will hold. 

Proposition 2. Let Wb = 2. There exists an integer s, s.t. if Wi = tUi+i = • • • = Wi+ S then |Lj+ s +i| < 
|Lj+s| ■ 


Proof. We will show that ([8]) will eventually be satisfied. From here, the claim will follow immediately. 

Suppose \Bi(wi-t+l)\ = P 2 nt-l \Bi( w i~t)\, where 0 <p < 1. Then \B i+1 (wi -f)| = ^\Bi(wi~t)\, 
and it can easily be verified that \Bi(wi—t+l)\ = \B%(wi~t)(p — 1 + 2" 2 )|, and since (p—1 + 2" 2 ) > 1 

for every n 2 ^ 1, we get that \B i+1 (wi~t+l)\ > k 2 lt-\ \B i+ i(wi-t)\. 

Next, suppose, ([7]) and ([8]) hold for j < s, but | Bi(s) \ = pi (fc2 + ,i2 )l B 'V 2 —, where 0 < p\ < 

1. Similarly, let |I3j + i(s)| = p 2 l fc2+ra2 ^ B,+1 ^ s 2 — )l B -+i( s 2 )l ^ f Qr some p 2 Then, it can be verified 


















that |B i+ i(s)| = Pl+ 2 2 „ 2 2 —- ■ ^ k2+n2 ^ B ' l ' s 2 — )l B ^ s . From the assumption that \Bi(s — 1 )| > 


|B i+1 (s-l)|, \Bi(s — 2)| > | B, 


■ , , Q 




n, _i_ 2" 2 — I 

P2 > - -2^1-> Le -’ 1 -PI > 2” 2 (1 -p 2 )- 

This means that either p 2 > 1, in which case either Q is satisfied for step i + 1, or if p 2 ^ 1, then it is 
2 n2 times closer to 1 than p\. Thus if we repeat the process for i + 2, i + 3, the sequence Pi,P 2 ,P 3 , ■ ■ ■ 
will either surpass 1 or will exponentially fast approach 1. When pi < 1 is very close to 1, (depending 
on the parameters) we can expect that ([8]) will be satisfied in the next step. □ 

For the practical parameters that will be given in Section |4j it was observed that | L i+S +i| < \Li+ s \ 
becomes true in just a couple of steps. 

The previous discussion was concerned with Steps i. when the weight Wi, does not change throughout 
the steps. Since in this case, the size of the lists |L,| will eventually (after a few steps) start decreasing, at 
one point the condition \Ln\ < L , will be satisfied, and Algorithm [2] will increase the weight to Wi+ \ = Wi. 
The goal of this step, is to increase the list again. A direct application of Lemma [l] yields: 

Proposition 3. Let wt = 2. Then, when w,; + i = Wi + 1, 


\L i+ i\ > \Li\ if and only if \B t \ > 


2" 2 — fc 2 — re 2 — 1 

( fc2 +n 2 ) 


\Li\- 


(9) 


□ 

For the chosen practical parameters from Section |4j the right hand side in will always be negative, 
and thus increasing the weight w t will always increase the size of the list. 


3.5 Complexity of Algorithm [2] 

We will first take a look at the first round since it is different from the rest. Filling up the list L\ would 
require testing all k\ + n± bit words ei of weight at most Wi for consistency with ([3]), and finding the 
appropriate vectors bi. The complexity of this part is 0({k\ + ni) u ' 1 fcin 2 ). This immediately implies 
that w i needs to be chosen very small, typically < 3. 

Next, at each Step i, we consider only e* of weight wt(ei ) ^ 2. Testing all the elements from 
would thus take |Li_i|(A: 2 +?z 2 ) 2 , and forming the list L; would take additional \Li\0((ki + (i— l)/c 2 )n 2 ) = 
\Li\0(k). Since we restrict the size of the lists to O(L), we have that the complexity of one round is 
O(Lk). In total there are v = 0(n) rounds, so the total complexity of the algorithm amounts to 0{Lkn). 
Note that this is only a rough estimate of the complexity, without taking into account any implementation 
optimizations. 


4 Practical Parameters and Experimental Results 

Following the design choices justified in the previous sections, we have formed several codes suitable for 
practical use. For all codes, w\ = 2 and Wb = 2. The other parameters are summarized in Table [2j 


Table 2. Parameters for St-Gen codes for matrix embedding 


m 

fci 

n 2 

fc 2 

Ci 

C (n « 1000) 

C (n « 1500) 

2 

14 

2 

1 

(3,1)1 

(1000,343) 

(1501,509) 

1 

14 

1 

1 

(2,1)1 

(1001,507) 

(1501,757) 

2 

14 

2 

3 

(5,3)1 

(999, 603) 

(1499,903) 

1 

14 

1 

2 

(3,2)1 

(1002,672) 

(1500,1004) 

1 

14 

1 

3 

(4,3)1 

(1003,755) 

(1503,1130) 

1 

14 

1 

4 

(5,4)1 

(1000,802) 

(1500,1202) 














We have performed an extensive set of experiments to test the performance of our codes in terms 
of their embedding efficiency e(a). The experiments were performed using an initial implementation in 
Magma m- All the results presented in this section are obtained as an average over 50 experiments for 
each code. 

Figure [3] provides a comparison of the St-Gen codes of length n ~ 1500 to other previously known 
codes: the binary Hamming codes [18] , the BDS codes [18] , the LDGM codes B3. as well as to two 
theoretically derived stego-code families (SCF) of Golay codes and LDGM codes [TO] , It can be seen 
from the figure that our codes have approximately the same embedding efficiency as the LDGM codes, 
with one important difference: The presented performance of the LDGM codes is achieved for much 
bigger lengths, namely for n = 10000. 


e(a) 



Fig. 3. Comparison of the embedding efficiency of St-Gen codes with other known codes for matrix embedding 


For lengths 1000 — 1500, the authors of [T3] provide information only for a = 1/2. Plotted together 
with our codes in Figure [4j we see that the embedding efficiency of the LDGM codes is quite smaller 
than that of the St-Gen codes. Our assumption is that the behaviour is similar for other embedding rates 
as well. 


e(a) 



Fig. 4. Comparison of the embedding efficiency of St-Gen codes for different lengths of the codes. 






We have also tested how well the experimental results fit the theoretical estimates from Theorem [T] 
Figure [5] shows a small offset between the two, and it remains an open problem to investigate whether 
the offset has a true significance. The last Figure [6j shows the difference in performance, obtained 
experimentally, depending on the choice of the round weight limit wt,. 


e(a) 



Fig. 5. Comparison of the theoretical results from 
Theorem [I] and the obtained practical results for 
St-Gen codes 

5 Conclusions 


e(a) 



Fig. 6. Comparison of the embedding efficiency of 
St-Gen codes for different choice of the round weight 
limit in Algoritam[2] 


We introduced a new family of binary linear codes called Staircase-Generated codes, whose structure 
is suitable for applying list decoding techniques. We proposed an algorithm that searches for a close 
codeword, and as our theoretical analysis and experiments confirm, it shows very good performance 
results: Our codes achieve approximately the same embedding efficiency as the currently best codes for 
matrix embedding, but for lengths at least an order of magnitude smaller. 

Having a proof of concept, our future work will be, firstly, directed towards making a fast, optimized 
implementation, for ex. in C, and applying different techniques for reducing the running time of the 
algorithm. On the theoretical side, we plan to extend the analysis to estimating the covering radius and 
the average distance of the codes for different and more general scenarios. 
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